@foir/cli 0.69.0 → 0.70.0

package/dist/lib/config-helpers.d.ts

@@ -179,8 +179,17 @@ interface AccessInput {
      *    (other operators can't see them unless shared).
      *  - `'project'` — no individual owner; records belong to the project. The
      *    platform default.
+     *  - `'organization'` — owned by one of the project's ORGANIZATIONS (the
+     *    tenants of a SaaS built on this project). Ownership, not containment:
+     *    the row stays in the project plane, so the project credential finds
+     *    every organization's rows — which is how a multi-tenant app resolves
+     *    `<sub>.theapp.com` to an org before it knows which org the request is
+     *    for. Written by the project (never on behalf of a customer), owner
+     *    named by `ownerId` or by the org the caller acts in (`X-Org-Id`);
+     *    `singleton` means one record per organization. Refused on a project
+     *    with no organizations and on a shared (layered/group) model.
      */
-    ownerPlane: 'customer' | 'admin' | 'project';
+    ownerPlane: 'customer' | 'admin' | 'project' | 'organization';
     /**
      * Visibility new records start at (the record descriptor modes):
      *  - `'private'` — only the owner and explicit grants.
@@ -285,11 +294,12 @@ interface ApplyConfigOperationInput {
     /** Precondition that must be met before execution (e.g., segment membership). */
     precondition?: Precondition;
     /**
-     * Execution mode the operation supports. `sync` blocks the platform worker
-     * on the HTTP call (≤30s realistically). `async` dispatches with
-     * 202-ack semantics — the extension returns 202 immediately and calls
-     * back via the typed GraphQL mutation when work completes. Use `async`
-     * for long-running work that exceeds the 30s wall clock.
+     * Execution mode the operation supports. `sync` blocks the caller on the
+     * dispatch reaching a terminal state, bounded by the platform's
+     * `SyncTimeout` of 60s. `async` dispatches with 202-ack semantics: the
+     * extension returns 202 immediately and calls back via the typed GraphQL
+     * mutation when work completes. Use `async` for long-running work that
+     * exceeds the 60s wall clock.
      *
      * There is only one flavour of async on the platform: the callback-based
      * handshake. The prior "fire-and-forget" meaning of async was retired
@@ -303,9 +313,9 @@ interface ApplyConfigOperationInput {
     mode?: 'sync' | 'async';
     /**
      * How long the platform waits for a callback before marking the execution
-     * `timed_out` and (per retry policy) re-queueing or sending to DLQ. Falls
-     * back to project setting `operations.callback_default_ttl`, then 24h.
-     * Clamped to [5m, 7d]. Only meaningful when `mode === 'async'`.
+     * `timed_out` and (per retry policy) re-queueing or sending to DLQ. Omit
+     * for the platform default of 24h. Clamped to [5m, 7d]. Only meaningful
+     * when `mode === 'async'`.
      */
     callbackTtlSeconds?: number;
     /**
@@ -548,7 +558,17 @@ interface ApplyConfigRelyingPartyInput {
     clientId: string;
     /** Display name shown on the hosted login. */
     name: string;
-    /** Allow-listed exact redirect URIs the platform will 302 to with the code. */
+    /**
+     * Allow-listed redirect URIs the platform will 302 to with the code, e.g.
+     * `['https://app.eide.clothing/auth/callback']`.
+     *
+     * Matched EXACTLY, including the path and query, so each deployment is listed
+     * in full. Wildcards are rejected rather than stored: a pattern would match
+     * only its own literal text, which reads like an allow-list entry and covers
+     * nothing. https, except on a loopback host (`http://127.0.0.1:8976/callback`)
+     * where a CLI or native app cannot hold a certificate. No fragment, no
+     * userinfo.
+     */
     redirectUris: string[];
     /** OAuth scopes the RP can request (intersection with caller scopes wins). */
     allowedScopes?: string[];
@@ -626,8 +646,27 @@ interface ApplyConfigApiKeyInput {
     scopes?: string[];
     /** Restrict the key to specific model keys (e.g. ["tilly_note", "tilly_block"]). */
     allowedModels?: string[];
-    /** Restrict file uploads to specific MIME types (e.g. ["image/*", "video/*"]). */
+    /** Restrict file uploads: a MIME type ("image/png"), a whole type ("image/*"), or IMAGE, VIDEO, FILE. */
     allowedFileTypes?: string[];
+    /**
+     * Confine the key to one ORGANISATION of this project, by id — the same value
+     * `foir api-keys create --confine-to-org` takes. An organisation is
+     * identified by a minted id, the way a project and a tenant are.
+     *
+     * A confined key reads and writes only that organisation's rows plus the
+     * project-shared tier, and the confinement travels on the credential rather
+     * than on any request, so nothing downstream can widen it.
+     *
+     * It is also part of the key's IDENTITY here, not just its configuration.
+     * Two organisations may each have a key named "Storefront", so the reconciler
+     * matches on name AND organisation; a manifest that declared one and omitted
+     * this field would be matched against the other one's key and rotate it.
+     *
+     * Set on CREATE only, like `configId` beside it: a key's organisation cannot
+     * be changed afterwards, and a manifest that moved one would be asking for a
+     * credential to change which tenant it belongs to.
+     */
+    org?: string;
 }
 /**
  * A customer RBAC role declared in foir.config.ts and reconciled by
@@ -662,6 +701,25 @@ interface ApplyConfigCustomerRoleInput {
      */
     isDefault?: boolean;
 }
+/**
+ * Saying "I do not want this one" about a source or sink the manifest marks
+ * optional.
+ *
+ * EXPLICIT, BECAUSE SILENCE IS THE WRONG DEFAULT HERE. An optional source left
+ * out of the config could be a decision or an oversight, and the two have
+ * opposite consequences: one is an operator who does not want their customers
+ * synced, the other is an operator who thinks they are and is wrong. So an
+ * optional source that is neither mapped nor declined is refused at push, with
+ * both spellings named. Nothing is submitted for a declined one, so the platform
+ * drops the operations that would have carried it and grants no capability for
+ * it.
+ *
+ *   sources: {
+ *     product:  { toModel: 'product', naturalKey: 'shopifyId', fields: { … } },
+ *     customer: false,   // this project does not sync customers
+ *   }
+ */
+type AppMappingDeclined = false;
 /**
  * Source-type mapping entry for an app install. Maps a manifest-declared
  * source type onto a project model. See docs/platform/apps.md §Mapping step.
@@ -698,8 +756,10 @@ interface AppInput {
     /** Opaque settings forwarded to the app's middleware. */
     settings?: Record<string, unknown>;
     mappings?: {
-        sources?: Record<string, AppSourceMappingInput>;
-        sinks?: Record<string, AppSinkMappingInput>;
+        /** `false` declines an OPTIONAL source. See AppMappingDeclined. */
+        sources?: Record<string, AppSourceMappingInput | AppMappingDeclined>;
+        /** `false` declines an OPTIONAL sink. See AppMappingDeclined. */
+        sinks?: Record<string, AppSinkMappingInput | AppMappingDeclined>;
         placementFields?: Record<string, AppPlacementFieldChoiceInput>;
     };
 }
@@ -758,6 +818,38 @@ interface ApplyConfigProjectSettingsInput {
      * Whether email one-time-code customer login is exposed. Default false.
      */
     customerOtpEnabled?: boolean;
+    /**
+     * Whether a signed-in customer may register an organization of their own
+     * through `registerOperatorOrganization`. Default false. Needs
+     * `operatorSignupRole` to name the role the founder is given, or the
+     * platform refuses every registration.
+     */
+    operatorSignupEnabled?: boolean;
+    /**
+     * The key of the customer role a self-registered organization's founder
+     * holds in it (a role of this project, e.g. `'operator'`). No default.
+     */
+    operatorSignupRole?: string;
+    /**
+     * The customer roles an organization's own staffer may hand out, by key.
+     *
+     * THE CEILING ON WHAT AN ORGANIZATION CAN BECOME, set by the party that is
+     * not inside it. An organization's staffer may add a member with a role only
+     * if the PROJECT declared that role assignable, which is why this is
+     * manifest-shaped and lives under project settings rather than anywhere an
+     * organization can reach.
+     *
+     * TRI-STATE, and the empty array is the point: omit it to leave the stored
+     * list alone, give a non-empty array to set it, and give an EMPTY array to
+     * take the capability away from every organization in the project. A bare
+     * "send nothing to clear" could not tell the last two apart.
+     *
+     * Every key must name a live customer role of this project. The platform
+     * refuses the whole list rather than dropping an entry it cannot resolve,
+     * because a list that quietly lost one is a capability an operator believes
+     * they granted and did not.
+     */
+    organizationAssignableRoles?: string[];
 }
 /** Self-serve signup mode, as authored in config-as-code. */
 type SignupModeName = 'public' | 'restricted' | 'waitlist' | 'closed';
@@ -808,11 +900,68 @@ interface ApplyConfigDesignTokensInput {
     /** Escape hatch for forward-compatible W3C groups (`spacing`, `border`, …). */
     [key: string]: unknown;
 }
+/**
+ * A whole config manifest: every family `foir push` reconciles, plus the
+ * config's own identity and the project pin.
+ *
+ * ⚠️ NO INDEX SIGNATURE, deliberately, and it used to have one. `[key: string]:
+ * unknown` made every top-level key legal, so a block spelled `organisations`
+ * instead of `organizations` — or one from a release this CLI does not have —
+ * type-checked, serialised, was accepted by the server's equally tolerant parse
+ * and applied by nothing. Both sides agreed. Nothing errored. The block did
+ * nothing, for as long as nobody looked. Without the signature, TypeScript's
+ * excess-property check refuses the literal at the point somebody writes it,
+ * which is the cheapest place this can possibly be caught.
+ *
+ * The server reports what it did not recognise as well, because a type check is
+ * only one of the two sides and a manifest can reach it from a hand-written
+ * JSON, an older CLI, or a generator.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHAT A PUSH DOES TO ORGANISATIONS
+ *
+ * A PUSH NEVER CREATES, MOVES, SUSPENDS OR DELETES AN ORGANISATION. Stated on
+ * the server too, beside the parser that would have to grow a family for it
+ * (`organisationPushRule` in the configs handler), because a rule held in one
+ * repository is a rule the other can contradict.
+ *
+ * Organisation POLICY is manifest-shaped and belongs here: whether self-serve
+ * sign-up is on, which role a founder is given, which roles an organisation may
+ * assign. Organisation INSTANCES are administrative state, like a customer or a
+ * credential's last use — created by an operator, by a customer signing up, or
+ * by a provisioning call, and suspended or deleted by deliberate acts with
+ * their own confirmations and their own audit trail.
+ *
+ * The reason it has to be said rather than assumed is this file's own prune
+ * rule: a family a manifest OMITS is a family whose resources this config owns
+ * and no longer wants. Apply that to organisations and a founder who pushed a
+ * config without an organisations block would lose a live tenant — every row,
+ * every customer, every credential — because a file did not mention it.
+ */
 interface ApplyConfigInput {
     key: string;
     name: string;
     configType?: string;
     force?: boolean;
+    /**
+     * Free text on the config row, for a reader rather than for the platform.
+     * Nothing resolves against it.
+     */
+    description?: string;
+    /**
+     * Which way content moves for this config: `'READ'` (the default),
+     * `'write'`, `'bidirectional'`. Recorded on the config row.
+     *
+     * A STRING. It was undeclared here until the manifest's top level gained a
+     * type at all, and one config in this repository had been sending the number
+     * `1` — which made the SERVER'S metadata decode fail outright, so that
+     * manifest's name, description and configType fell through to defaults on
+     * every push. One key of the wrong type, every metadata field silently
+     * dropped, nothing reported anywhere.
+     */
+    direction?: string;
+    /** The domain a connector-shaped config talks to. Recorded on the row. */
+    connectionDomain?: string;
     /** Base URL prepended to relative operation endpoints. */
     operationBaseUrl?: string;
     /**
@@ -854,7 +1003,19 @@ interface ApplyConfigInput {
      * only — see ApplyConfigEmailCopyInput for why it never prunes).
      */
     emailCopy?: ApplyConfigEmailCopyInput[];
-    [key: string]: unknown;
+    /**
+     * The project's bring-your-own transactional email sender: `fromEmail` and a
+     * `resendKeySecretRef`. REF ONLY — the raw key is never in the committed
+     * manifest; it is written out of band with `foir secrets put` and this
+     * references the resulting vault ref. Omitted leaves the sender unchanged.
+     */
+    projectEmail?: ApplyConfigProjectEmailInput;
+}
+/** The project's own email sender, as authored in config-as-code. */
+interface ApplyConfigProjectEmailInput {
+    fromEmail?: string;
+    /** A vault ref, never a key. `foir secrets put` mints one. */
+    resendKeySecretRef?: string;
 }
 /** Define a complete config manifest. */
 declare function defineConfig(config: ApplyConfigInput): ApplyConfigInput;
@@ -927,4 +1088,4 @@ interface FoirSecretsConfig {
  */
 declare function defineSecrets(config: FoirSecretsConfig): FoirSecretsConfig;
 
-export { type AccessInput, type AppInput, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigEmailCopyInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type ApplyConfigVariantCatalogEntryInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldPlacement, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SignupModeName, type SignupRestrictionsInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEmailCopy, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };
+export { type AccessInput, type AppInput, type AppMappingDeclined, type AppPlacementFieldChoiceInput, type AppSinkMappingInput, type AppSourceMappingInput, type ApplyConfigApiKeyInput, type ApplyConfigAuthProviderInput, type ApplyConfigContextDimensionInput, type ApplyConfigCustomerRoleInput, type ApplyConfigDesignTokensInput, type ApplyConfigEmailCopyInput, type ApplyConfigHookInput, type ApplyConfigInput, type ApplyConfigLocaleInput, type ApplyConfigModelInput, type ApplyConfigOperationInput, type ApplyConfigPlacementInput, type ApplyConfigProjectEmailInput, type ApplyConfigProjectInput, type ApplyConfigProjectSettingsInput, type ApplyConfigRelyingPartyInput, type ApplyConfigRelyingPartyLoginMethods, type ApplyConfigScheduleInput, type ApplyConfigVariantCatalogEntryInput, type EnumFieldConfig, type EnumFieldDefinitionInput, type EnumFieldOption, type FieldAccessInput, type FieldDefinitionInput, type FieldPlacement, type FieldRelationshipInput, type FoirSecretsConfig, type LookupDefinitionInput, type QuotaRule, type ReferenceFieldConfig, type ReferenceFieldDefinitionInput, type SecretDeclaration, type SecretOwnerKind, type SelectFieldConfig, type SelectFieldDefinitionInput, type SignupModeName, type SignupRestrictionsInput, defineAuthProvider, defineConfig, defineContextDimension, defineDesignTokens, defineEmailCopy, defineEnumField, defineField, defineHook, defineLocale, defineModel, defineOperation, definePlacement, defineRelyingParty, defineSchedule, defineSecrets, defineSelectField, defineVariantCatalogEntry };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foir/cli",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -62,10 +62,10 @@
     "typescript": "5.9.2",
     "vitest": "^3.2.4",
     "@foir/assistant": "0.0.0",
-    "@foir/console-routes": "0.0.0",
-    "@foir/proto-ts": "0.109.0",
+    "@foir/sdk": "0.10.0",
     "@foir/rpc-node": "0.0.0",
-    "@foir/sdk": "0.9.0"
+    "@foir/proto-ts": "0.109.0",
+    "@foir/console-routes": "0.0.0"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -75,7 +75,7 @@
     "url": "https://github.com/eidestudio/foir-cli.git"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node scripts/smoke-bundle.mjs",
     "dev:cli": "tsx src/cli.ts",
     "check-types": "tsc --noEmit",
     "lint": "eslint src/",